La API de pagos para Colombia.
Webhooks incluidos.

1curl https://api.onepay.la/v1/payments \
2  -X POST \
3  -H "Authorization: Bearer sk_test_..." \
4  -H "Content-Type: application/json" \
5  -H "x-idempotency: factura-1234" \
6  -d '{
7    "amount": 150000,
8    "currency": "COP",
9    "title": "Factura #1234",
10    "phone": "+573201112233",
11    "email": "pagador@ejemplo.com",
12    "reference": "FAC-1234",
13    "expiration_date": "2026-10-31 23:59:59",
14    "allows": { "cards": true, "pse": true, "wallets": true, "breb": true }
15  }'

1import crypto from "node:crypto";
2import express from "express";
3
4const app = express();
5
6const safeEqual = (a, b) =>
7  a.length === b.length && crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
8
9// Usa el cuerpo sin parsear: si lo reserializas, la firma no coincide.
10app.post("/webhooks/onepay", express.raw({ type: "application/json" }), (req, res) => {
11  const expected = crypto
12    .createHmac("sha256", process.env.ONEPAY_WEBHOOK_SECRET)
13    .update(req.body)
14    .digest("hex");
15
16  const valid =
17    safeEqual(req.get("x-webhook-token") ?? "", process.env.ONEPAY_WEBHOOK_TOKEN) &&
18    safeEqual(req.get("signature") ?? "", expected);
19
20  if (!valid) return res.sendStatus(401);
21
22  const payload = JSON.parse(req.body.toString());
23  console.log(payload.event.type); // "payment.approved", "invoice.paid", ...
24  res.sendStatus(200); // responde 2xx en menos de 10 segundos
25});